When will Apple and Google come out and say "no" to this? What is the legislative mechanism that gives the Dept of Commerce control over what code (speech) is transmitted on their app platform? Calling it a "transaction" is a stretch - using that logic, Department of Commerce could ban any online download they wanted. That's clearly not a good outcome, and not an interpretation we as technologists should accept.
Can't they? Aren't there bans on open source contributions between Iran and the US? See: https://github.com/1995parham/github-do-not-ban-us
But unfortunately the executive has been granted a lot of ambiguous and murky power under the guise of "national security" and things like that, so I wouldn't be surprised if these actions are indeed legal, but the root of the legality is something other than ITAR or OFAC.